APT30 Analisi

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (7)

Linguaggio

zh	4
en	4

Nazione

cn	4
us	4

Attori

APT30	1

Interesse

Genere

Network Management Software	2
Groupware Software	2
Operating System	2

Fornitore

Not Defined	2
Microsoft	2
Linux	2

Prodotto

Zabbix	2
Microsoft Exchange Server	2
Linux Kernel	2

Vulnerabilità

#	Vulnerabilità	Base	Temp	0day	Oggi	Sfr	Con	EPSS	CTI	CVE
1	Combodo iTop config.php TestConfig escalazione di privilegi	6.7	6.7	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00089	0.04	CVE-2018-10642
2	Inter7 SqWebMail Error Message rivelazione di un 'informazione	5.3	5.3	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00591	0.00	CVE-2004-2313
3	Softnext SPAM SQR escalazione di privilegi	7.2	7.2	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00143	0.04	CVE-2023-24835
4	Microsoft Exchange Server Privilege Escalation	8.8	7.7	$25k-$100k	$0-$5k	Proof-of-Concept	Official Fix	0.01258	0.00	CVE-2021-28482
5	Linux Kernel z90crypt_unlocked_ioctl escalazione di privilegi	5.9	5.6	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00042	0.02	CVE-2009-1883
6	Zabbix Dashboard Page autenticazione debole	8.2	8.2	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.35520	0.00	CVE-2019-17382

IOC - Indicator of Compromise (4)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	indirizzo IP	Hostname	Attore	Identified	Genere	Fiducia
1	5.1.0.29	5-1-0-29.datagroup.ua	APT30	26/12/2020	verified	Alto
2	XXX.XXX.XX.XXX		Xxxxx	19/02/2024	verified	Alto
3	XXX.XXX.X.XXX		Xxxxx	24/12/2020	verified	Alto
4	XXX.XXX.XXX.XXX		Xxxxx	19/02/2024	verified	Alto

TTP - Tactics, Techniques, Procedures (4)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Vulnerabilità	Accesso al vettore	Genere	Fiducia
1	T1059	CWE-94	Argument Injection	predictive	Alto
2	TXXXX	CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Alto
3	TXXXX	CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Alto
4	TXXXX	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Alto

IOA - Indicator of Attack (2)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Genere	Fiducia
1	File	web/env-production/itop-config/config.php	predictive	Alto
2	File	xxxxxx.xxx?xxxxxx=xxxxxxxxx.xxxx&xxxxxxxxxxx=x	predictive	Alto

Referenze (4)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrecedenteVisione D'insiemeIl prossimo ▸

Do you want to use VulDB in your project?

Use the official API to access entries easily!